CVE-2026-108837: apache software foundation apache kylin

CVSS: UnknownDeferred

Published 19-10-2026Last modified 19-10-2026

Open JSON

Vulnerability summary

CVE-2026-108837 is a vulnerability in apache software foundation apache kylin with no CVSS score yet.

Overall risk

0/100

0100

Minimal · default modelHow is this calculated?

CVSS score

Not scored

010

No CVSS score recorded

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

19-10-2026
PublishedVulnerability first disclosed.
19-10-2026
Last modifiedVulnerability information updated.

Description

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Apache software foundation1 product

apache kylin≥ 4.0.0, ≤ 5.0.4

1 vendor · 1 product

References

2 links